We are trying to be PCI compliant, and one of their sticking points is that the LOGIN SIDEBOX is being displayed over an insecure HTTP connection. We told them that it shouldn't matter......that even though the login form is DISPLAYED on an HTTP connection, the actual FORM ACTION is submitting to a secure HTTPS connection:

https://www.domain.com/store/login.html?action=process

However, they countered by saying that if you manually EDIT the secure login URL (by changing the HTTPS into HTTP), it will still load the login page. In other words, they're saying that this (http://www.domain.com/store/login.html?action=process) should redirect back to this (https://www.domain.com/store/login.html?action=process). Likewise this (http://www.domain.com/store/login.html) should redirect to this (https://www.domain.com/store/login.html).

Any idea how to do that?

I did have the following added to the root directory of my HTACCESS file but it's not doing anything:

RewriteRule ^store\/login\.html$ "https\:\/\/www\.domain\.com\/store\/login\.html" [R=301,L]

Even after adding that and restarting Apache, I can still manually go to http://www.domain.com/store/login.html (without the HTTPS redirect).

Any ideas on what else I should be looking at?